Jamf Pro API – Get Jamf Notifications

For this post, I wanted to share how to get important notifications that may be on your Jamf Pro server without having to actually open a web browser, navigating to your Jamf Pro server, logging in, and viewing the notifications.

This task can be done utilizing the Jamf Pro API. The endpoint we will be focusing on is /api/v1/notifications

Why is this important? Jamf Pro will notify if there are issues that need to be addressed. These notifications can include things like the ADE token expiring soon, the APNS certificate is expired, or errors with the connected Jamf Infrastructure Manager. There is a need to get alerted on these notifications so the issues can be addressed before they become part of a much larger issue.

Let’s dig in…

When using the Jamf Pro API, a valid Jamf Pro account is needed. When creating Jamf Pro User Accounts for the purpose of using with the API, refer to the following link on what permissions are needed for each specific task:
https://developer.jamf.com/jamf-pro/docs/privileges-and-deprecations

For the endpoint /v1/notifications with the get operation, there are no privileges needed. This service can be created with no privileges and it will still work for this purpose.

Now that the account is created in Jamf Pro, we can start building the script that we will use.

When using the Jamf Pro API, we need to use an account to authenticate, we will use the account created in the previous step and we will look at how to generate a bearer token with the API. Supply the correct username, password, and Jamf Pro URL and our script will use those variables to generate a bearer token that will be used to authorize our API calls.

#!/bin/bash

# API Credentials
jamfUser="api_Notifications"
jamfPass="jamf1234"
jssURL="https://techitout.jamfcloud.com"

# Encode Credentials
encodedCredentials=$( printf "${jamfUser}:${jamfPass}" | /usr/bin/iconv -t ISO-8859-1 | /usr/bin/base64 -i - )

# Generate an auth token
authToken=$( /usr/bin/curl "${jssURL}/uapi/auth/token" \
--silent \
--request POST \
--header "Authorization: Basic ${encodedCredentials}"
)

# Parse authToken for token, omit expiration
token=$( /usr/bin/awk -F \" '{ print $4 }' <<< "${authToken}" | /usr/bin/xargs )

If we then do an echo $token we can see our Bearer Token value:

username@computername ~ % echo $token
eyJhbGciOiJIUzI1NiJ9.eyJhdXRoZW50aWNhdGVkLWFwcCI6IkdFTkVSSUMiLCJhdXRoZW50aWNhdGlvbi10eXBlIjoiSlNTIiwiZ3JvdXBzIjpbXSwic3ViamVjdC10eXBlIjoiSlNTX1VTRVJfSUQiLCJ0b2tlbi11dWlkIjoiY2JhMDU5ZDYtZGNiNC00ZDg2LTg5MjYtMTc0NGZkOGY4YzI0IiwibGRhcC1zZXJ2ZXItaWQiOi0xLCJzdWIiOiIxMyIsImV4cCI6MTY0ODY4MjkzN30.FF5s6LcNJue-tkCcMSf7zlOWRTf-Kv30K-eGwVVddF0

Now that we have the authentication portion of our script taken care of, we can now build the rest of our script. There are several possible notifications that Jamf Pro can give us, we can take these values and store them in an array of possibilities like this:

# Build an array of possible important notifications from Jamf Pro
noticationsArr=(
	APNS_CERT_REVOKED
	APNS_CONNECTION_FAILURE
	APPLE_SCHOOL_MANAGER_T_C_NOT_SIGNED
	BUILT_IN_CA_EXPIRED
	BUILT_IN_CA_EXPIRING
	BUILT_IN_CA_RENEWAL_FAILED
	BUILT_IN_CA_RENEWAL_SUCCESS
	CLOUD_LDAP_CERT_EXPIRED
	CLOUD_LDAP_CERT_WILL_EXPIRE
	COMPUTER_SECURITY_SSL_DISABLED
	DEP_INSTANCE_EXPIRED
	DEP_INSTANCE_WILL_EXPIRE
	DEVICE_ENROLLMENT_PROGRAM_T_C_NOT_SIGNED
	EXCEEDED_LICENSE_COUNT
	FREQUENT_INVENTORY_COLLECTION_POLICY
	GSX_CERT_EXPIRED
	GSX_CERT_WILL_EXPIRE
	HCL_BIND_ERROR
	HCL_ERROR
	INSECURE_LDAP
	INVALID_REFERENCES_EXT_ATTR
	INVALID_REFERENCES_POLICIES
	INVALID_REFERENCES_SCRIPTS
	JAMF_CONNECT_UPDATE
	JAMF_PROTECT_UPDATE
	JIM_ERROR
	LDAP_CONNECTION_CHECK_THROUGH_JIM_FAILED
	LDAP_CONNECTION_CHECK_THROUGH_JIM_SUCCESSFUL
	MDM_EXTERNAL_SIGNING_CERTIFICATE_EXPIRED
	MDM_EXTERNAL_SIGNING_CERTIFICATE_EXPIRING
	MDM_EXTERNAL_SIGNING_CERTIFICATE_EXPIRING_TODAY
	MII_HEARTBEAT_FAILED_NOTIFICATION
	MII_INVENTORY_UPLOAD_FAILED_NOTIFICATION
	MII_UNATHORIZED_RESPONSE_NOTIFICATION
	PATCH_EXTENTION_ATTRIBUTE
	PATCH_UPDATE
	POLICY_MANAGEMENT_ACCOUNT_PAYLOAD_SECURITY_MULTIPLE
	POLICY_MANAGEMENT_ACCOUNT_PAYLOAD_SECURITY_SINGLE
	PUSH_CERT_EXPIRED
	PUSH_CERT_WILL_EXPIRE
	PUSH_PROXY_CERT_EXPIRED
	SSO_CERT_EXPIRED
	SSO_CERT_WILL_EXPIRE
	TOMCAT_SSL_CERT_EXPIRED
	TOMCAT_SSL_CERT_WILL_EXPIRE
	USER_INITIATED_ENROLLMENT_MANAGEMENT_ACCOUNT_SECURITY_ISSUE
	USER_MAID_DUPLICATE_ERROR
	USER_MAID_MISMATCH_ERROR
	USER_MAID_ROSTER_DUPLICATE_ERROR
	VPP_ACCOUNT_EXPIRED
	VPP_ACCOUNT_WILL_EXPIRE
	VPP_TOKEN_REVOKED
	DEVICE_COMPLIANCE_CONNECTION_ERROR
	CONDITIONAL_ACCESS_CONNECTION_ERROR
	AZURE_AD_MIGRATION_REPORT_GENERATED
)

We now know what the possible notifications are, so let’s get the notifications from our Jamf Pro server. Notice this is where we use our Bearer token that was generated earlier:

# Returns important notifications from Jamf Pro in JSON
data=$( curl --request GET \
--url "${jssURL}/api/v1/notifications" \
--header "Accept: application/json" \
--header "Authorization: Bearer ${token}" \
)

The next step we need to do is set up a loop to find our notifications match a notification in the array that we set earlier. The logic for this loop will look like:

for str in ${notificationsArr[@]}; do
   if [[ " ${data} " =~ ${str} ]]; then
      # Notification in list matches notification from $data
   fi
done

Now, I’m sure that we want to do more with this data than just compare to a list. The next step is to populate our loop with useful steps that will give us the information that we want to know in a readable form.

# Loop each notification possibility and if it exists in the results, grab information on the notification using jq and notify
for str in ${noticationsArr[@]}; do
	if [[ " ${data} " =~ ${str} ]]; then
		# Create a clean string for read ability
		cleanString=$( echo $str | sed 's/_/ /g' )
		name=$( echo ${data} | jq --arg v "${str}" '.[]|select(.type==$v).params.name')
		# Create a clean name for read ability
		cleanname=$( echo $name | sed 's/"//g')
		days=$( echo ${data} | jq --arg v "${str}" '.[]|select(.type==$v).params.days')
		id=$( echo ${data} | jq --arg v "${str}" '.[]|select(.type==$v).params.id')
		if [[ ${name} != "null" ]]; then
			if [[ ${days} != "null" ]]; then
				if [[ ${id} != "null" ]]; then
					message=$( echo "$JPInstance Notification: $cleanString for $cleanname in $days days" )
				else
					message=$( echo "$JPInstance Notification: $cleanString for $cleanname in $days days" )
				fi
			else
				message=$( echo "$JPInstance Notification: $cleanString for $name" )
			fi
		else
			message=$( echo "$JPInstance Notification: $cleanString" )
		fi
		# Echo the message for each alert
        echo ${message}
	fi
done

Putting it all together:

#!/bin/bash

# API Credentials
jamfUser="api_Notifications"
jamfPass="jamf1234"
jssURL="https://techitout.jamfcloud.com"

# Encode Credentials
encodedCredentials=$( printf "${jamfUser}:${jamfPass}" | /usr/bin/iconv -t ISO-8859-1 | /usr/bin/base64 -i - )

# Generate an auth token
authToken=$( /usr/bin/curl "${jssURL}/uapi/auth/token" \
--silent \
--request POST \
--header "Authorization: Basic ${encodedCredentials}"
)

# Parse authToken for token, omit expiration
token=$( /usr/bin/awk -F \" '{ print $4 }' <<< "${authToken}" | /usr/bin/xargs )

# Build an array of possible important notifications from Jamf Pro
noticationsArr=(
	APNS_CERT_REVOKED
	APNS_CONNECTION_FAILURE
	APPLE_SCHOOL_MANAGER_T_C_NOT_SIGNED
	BUILT_IN_CA_EXPIRED
	BUILT_IN_CA_EXPIRING
	BUILT_IN_CA_RENEWAL_FAILED
	BUILT_IN_CA_RENEWAL_SUCCESS
	CLOUD_LDAP_CERT_EXPIRED
	CLOUD_LDAP_CERT_WILL_EXPIRE
	COMPUTER_SECURITY_SSL_DISABLED
	DEP_INSTANCE_EXPIRED
	DEP_INSTANCE_WILL_EXPIRE
	DEVICE_ENROLLMENT_PROGRAM_T_C_NOT_SIGNED
	EXCEEDED_LICENSE_COUNT
	FREQUENT_INVENTORY_COLLECTION_POLICY
	GSX_CERT_EXPIRED
	GSX_CERT_WILL_EXPIRE
	HCL_BIND_ERROR
	HCL_ERROR
	INSECURE_LDAP
	INVALID_REFERENCES_EXT_ATTR
	INVALID_REFERENCES_POLICIES
	INVALID_REFERENCES_SCRIPTS
	JAMF_CONNECT_UPDATE
	JAMF_PROTECT_UPDATE
	JIM_ERROR
	LDAP_CONNECTION_CHECK_THROUGH_JIM_FAILED
	LDAP_CONNECTION_CHECK_THROUGH_JIM_SUCCESSFUL
	MDM_EXTERNAL_SIGNING_CERTIFICATE_EXPIRED
	MDM_EXTERNAL_SIGNING_CERTIFICATE_EXPIRING
	MDM_EXTERNAL_SIGNING_CERTIFICATE_EXPIRING_TODAY
	MII_HEARTBEAT_FAILED_NOTIFICATION
	MII_INVENTORY_UPLOAD_FAILED_NOTIFICATION
	MII_UNATHORIZED_RESPONSE_NOTIFICATION
	PATCH_EXTENTION_ATTRIBUTE
	PATCH_UPDATE
	POLICY_MANAGEMENT_ACCOUNT_PAYLOAD_SECURITY_MULTIPLE
	POLICY_MANAGEMENT_ACCOUNT_PAYLOAD_SECURITY_SINGLE
	PUSH_CERT_EXPIRED
	PUSH_CERT_WILL_EXPIRE
	PUSH_PROXY_CERT_EXPIRED
	SSO_CERT_EXPIRED
	SSO_CERT_WILL_EXPIRE
	TOMCAT_SSL_CERT_EXPIRED
	TOMCAT_SSL_CERT_WILL_EXPIRE
	USER_INITIATED_ENROLLMENT_MANAGEMENT_ACCOUNT_SECURITY_ISSUE
	USER_MAID_DUPLICATE_ERROR
	USER_MAID_MISMATCH_ERROR
	USER_MAID_ROSTER_DUPLICATE_ERROR
	VPP_ACCOUNT_EXPIRED
	VPP_ACCOUNT_WILL_EXPIRE
	VPP_TOKEN_REVOKED
	DEVICE_COMPLIANCE_CONNECTION_ERROR
	CONDITIONAL_ACCESS_CONNECTION_ERROR
	AZURE_AD_MIGRATION_REPORT_GENERATED
)

# Returns important notifications from Jamf Pro in JSON
data=$( curl --request GET \
--url "${jssURL}/api/v1/notifications" \
--header "Accept: application/json" \
--header "Authorization: Bearer ${token}" \
)

# Loop each notification possibility and if it
# exists in the results, grab information on the
# notification using jq and notify
for str in ${noticationsArr[@]}; do
	if [[ " ${data} " =~ ${str} ]]; then
		cleanString=$( echo $str | sed 's/_/ /g' )
		name=$( echo ${data} | jq --arg v "${str}" '.[]|select(.type==$v).params.name')
		cleanname=$( echo $name | sed 's/"//g')
		days=$( echo ${data} | jq --arg v "${str}" '.[]|select(.type==$v).params.days')
		id=$( echo ${data} | jq --arg v "${str}" '.[]|select(.type==$v).params.id')
		if [[ ${name} != "null" ]]; then
			if [[ ${days} != "null" ]]; then
				if [[ ${id} != "null" ]]; then
					message=$( echo "$JPInstance Notification: $cleanString for $cleanname in $days days" )
				else
					message=$( echo "$JPInstance Notification: $cleanString for $cleanname in $days days" )
				fi
			else
				message=$( echo "$JPInstance Notification: $cleanString for $name" )
			fi
		else
			message=$( echo "$JPInstance Notification: $cleanString" )
		fi
		echo $message
		
	fi
done
	
exit 0

This will yield results similar to:

TECHITOUT Notification: DEP INSTANCE WILL EXPIRE for TIO ABM in 17 days
TECHITOUT Notification: USER INITIATED ENROLLMENT MANAGEMENT ACCOUNT SECURITY ISSUE

And thats it. I’ve also put it up on my GitHub: https://github.com/robjschroeder/Jamf-API-Scripts/blob/main/api-GetJPNotifications.sh

Thanks for checking it out!

Jamf Pro API – Get Jamf Notifications

Like this:

Leave a ReplyCancel reply

Jamf Pro API – Get Jamf Notifications

Share this:

Like this:

Leave a ReplyCancel reply